September 2017 - anti-abuse-wg

Re: [anti-abuse-wg] 2017-02 New Policy Proposal (Regular abuse-c Validation)
by Nick Hilliard 11 Sep '17

11 Sep '17

> The goal of this proposal is to give the RIPE NCC a mandate to > regularly validate "abuse-c:" information and to follow up in cases > where contact information is found to be invalid. which states: > b. Arguments opposing the proposal [...] > If organisations are not cooperative, the RIPE NCC ultimately has the > possibility to close their RIPE NCC membership and deregister their > Internet number resources. The most serious problem with this proposal is that it's saying: "make sure your abuse-c mailbox is working and if it isn't, this proposal is explicitly threatening that the RIPE NCC can take your numbering resources away". This is a highly aggressive approach and I don't think this is a viable or appropriate way of handling stewardship of IP numbering resources, and particularly not from a monopoly organisation. Useful abuse management is far more than tickbox compliance with having your abuse-c mailbox connected up to an autoresponder. A working abuse-c mailbox is great, but mandating this requirement in this way is going to turn the abuse-c mechanism into a window-dressing exercise which can be satisfied by an autoresponder. On this basis I don't support this proposal. Why didn't the authors just talk to the RIPE NCC and ask them to include abuse-c validation in the Assisted Registry Check? This seems like a far less heavy-handed option than creating a policy proposal. It also involves better quality community outreach, and without the threat of aggression implicit in proposal 2017-02. Nick

1 0

Re: [anti-abuse-wg] [db-wg] RIPE Policy Proposal 2017-02 Validates Database Attributes
by Sascha Luck [ml] 10 Sep '17

10 Sep '17

All, I will discuss this here as I do not accept the Anti-Abuse WG as a forum for this proposal. For one thing, this proposal affects every ripedb user - in fact, as this entails changes to how the NCC provides services, the services-wg would be an even better venue. For another, given the "population" and culture of "debate" on the AAWG, any "consensus" reached there would be so worthless as to be farcical. (If anyone wants amplification on this, https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/ provides ample evidence. To the meat of the proposal: Firstly, this proposal conflicts somewhat with NWI-7 in this very WG. (Another reason why it should have gone here in the first place) With the upcoming possibility of delegating abuse-c: to (customers') resource objects, who bears any consequences of these customers not replying to this proposed email? >Rationale >a. Arguments supporting the proposal >Accurate and validated information in the RIPE Database is >essential to establish a trusted and transparent environment in >which all network operators can operate safely. abuse-c: is a contact object, just as admin-c: or tech-c: and (correct me if I'm wrong) audited at the same time as the rest of the contact information. What makes it so unique that this verification is not enough? >Accurate and >validated information helps Internet troubleshooting at all >levels, >but it also helps to attribute malicious online >activities that undermine this trusted environment. See above. >The lack of reliable accurate and validated information in the >database negatively impacts legitimate uses of the RIPE Database, >including: An *email adress* that doesn't reply once a year does NOT equate to a "lack of reliable accurate and validated information". I find this statement somewhat insulting to the NCC team who do make the effort to keep the ripedb data accurate and do audit resource holders. There is an issue with the reliability of out-of-region and legacy resource data but as the NCC has no "enforcement" powers over these resource holders, in these cases this proposal snatches at thin air. >Assuring the security and reliability of the network by >identifying points of contact for IP addresses for network >operators, ISPs, and certified computer incident response teams; "org:", "admin-c:", "tech-c:", "mnt-by:" and, yes, "abuse-c:" exist. >Ensuring that IP address holders are accountable, so individuals, >consumers and the public are empowered to resolve abusive >practices that impact safety and security; >Assisting businesses, consumer groups, healthcare organisations >and other organisations that are combating fraud (some of which >have mandates to electronically save records) to comply with >relevant legal and public safety safeguards; The contact object that does (or *should*) stand for the person(s) who can speak for a LIR, legally, is "admin-c:". "abuse-c:" is some role account in a NOC or even a ticket system unlikely to have any decision-making power. An attempt to make these roles (perhaps even personally) responsible for the behaviour of a LIR and its customers is counter-productive. I for one would flatly refuse to do any abuse report handling under these circumstances. >Complying with national, civil and criminal due process laws in >support of investigations and providing justice for victims. Would the proposers please amplify exactly which law or due process is violated by the NCC not sending an email once a year to an abuse-c:? Myself, and I'm sure the NCC legal team, would be interested to know. On a technical note, email is neither a secure nor a reliable transport for such verification. In the day of blocklists and large email providers imposing arbitrary restrictions on email senders it is not guaranteed that a verification email reaches the intended address or that a reply reaches the sender. The NCC ARC procedure, however employs both email and personal contact via telephone to verify the accuracy of the ripedb information. In toto, this proposal would impose unneccessary work on LIRs and the NCC, using unsuitable means to rectify a non-existing issue, and I therefore oppose it.

4 3

Re: [anti-abuse-wg] [db-wg] RIPE Policy Proposal 2017-02 Validates Database Attributes
by phishing＠storey.xxx 09 Sep '17

09 Sep '17

1 0

oppose 2017-02 "Regular abuse-c Validation"
by Peter Hessler 08 Sep '17

08 Sep '17

STRONG OPPOSITION! As an operator who has to read abuse-c emails, this is a waste of my time. I have real things to do, instead of bothering with this kind of crap. Responding to RIPE ping mails does not mean an abuse-c will respond to emails from non-RIPE entities, nor that a mailbox will keep working in-between pings. This is simply busy work, and has no value. Additionally, the threat that RIPE will deregister for failure to respond is insulting, vulgar, and obscene. -- Katz' Law: Man and nations will act rationally when all other possibilities have been exhausted.

4 3

Re: [anti-abuse-wg] 2017-02 New Policy Proposal (Regular abuse-c Validation)
by phishing＠storey.xxx 08 Sep '17

08 Sep '17

1 0

FW: RIPE Policy Proposal 2017-02 Validates Database Attributes
by Erik Bais 08 Sep '17

08 Sep '17

Sorry for cross posting. This should have go to the correct WG for the policy. Erik On 08/09/2017, 09:22, "Erik Bais" <ebais(a)a2b-internet.com> wrote: Hi, Having correct and up to date contact information is already a part of the ARC Process for the RIPE NCC. Each and every LIR will get a regular out-reach call / email from the RIPE NCC to go over their contact details, specific questions about their resources, usage and other stuff. Not having a valid or up to date or working abuse mailbox as an option to be able to de-register resources is something I would not recommend. Any kind of de-registration of resources should not be dictated by only a missing or invalid abuse-c … This means that if by some reason .. a LIR can’t be reached by mail, it might cause their resources to be removed … So I would strongly object to this policy or kind of thinking. You also need to keep in mind that there are a lot of resource holders that have no contract (Legacy holders) with the RIPE NCC.. so RIPE wouldn’t even be able to enforce this. Also, the Legacy space is not under policy .. so the biggest group of ‘problematic’ resources won’t be fixed by this .. Regards, Erik Bais On 07/09/2017, 14:05, "Marco Schmidt" <mschmidt(a)ripe.net> wrote: Dear colleagues, We just published RIPE Policy proposal, 2017-02, "Regular abuse-c Validation", to the Anti-Abuse Working Group mailing list. The goal of this proposal is to give the RIPE NCC a mandate to regularly validate "abuse-c:" information, and to follow up in cases where contact information is found to be invalid. As this proposal relates to contact information put into the RIPE Database, we would like to notify the Database Working Group specifically. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2017-02 We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 6 October 2017. Regards, Marco Schmidt Policy Development Officer RIPE NCC Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

1 0

upcoming policy proposal for Anti-Abuse WG
by Marco Schmidt 01 Sep '17

01 Sep '17

Hello Brian and Tobias, How are you? You got already your ticket to Dubai? I just want to inform you that likely a policy proposal will find a way to your working group. Gregory from Europol just contacted me, as he want to add a validation requirement to the policy "Abuse Contact Management in the RIPE Database". His proposal looked pretty advanced to me. I gave him some feedback and explained how to start the formal PDP - by contacting you :) I told Greg to put me in cc when he'll send you the proposal. In case he forgets this, can you please add me in your potential reply so I can start the preparation for the publishing? Regards, Marco

3 3

Something to think about when considering abuse
by ox 01 Sep '17

01 Sep '17

Hi, Not sure if any of you saw this, Re: EU Commissioner and how it is probably good idea to not criticize Google if you have absolutely any dealings with it. https://www.nytimes.com/2017/08/30/us/politics/eric-schmidt-google-new-amer… Some of us may have already learned this the hard way. I think abuse from and by huge multinationals requires 'special' rules/approach/etc - as fallout and silent discrimination or "black balling" is a reality. As electronic intelligence takes over many functions, this type of abuse can actually be invisible and very pervasive in its silent erosive destruction. Maybe not as much from Google right now, (as imho Google's evil is still evolving) but some of the others are more active. Although, at Google, evil has entered the mono culture and reasoning with someone that "is in charge" is not that easy/possible as they are the final word. Andre

1 0